flux fleet digest — 2026-09-26 07:49 UTC
Fleet overview (last 24h vs 7-day baseline)
| sensor |
events |
uniq IPs |
7d avg events |
7d avg uniq |
events delta |
| ai-devbox-1 |
1869 |
100 |
3821 |
533 |
-51% |
| canary-farm-1 |
6769 |
137 |
4676 |
201 |
+45% |
| control-1 |
5606 |
114 |
4462 |
115 |
+26% |
| frantech-ts |
1216 |
92 |
14787 |
251 |
-92% |
| lauterbourg-01-ts |
2374 |
121 |
0 |
0 |
n/a |
| netcup-ts |
1087 |
97 |
7372 |
87 |
-85% |
| ru-edge-1 |
559 |
93 |
4434 |
806 |
-87% |
| sponge-01-ts |
1128 |
81 |
2519 |
108 |
-55% |
Sensors discovered in the sink: ai-devbox-1, canary-farm-1, control-1, frantech-ts, lauterbourg-01-ts, netcup-ts, ru-edge-1, sponge-01-ts.
Result-tag spikes (campaign candidates)
| sensor |
result |
24h |
7d avg |
ratio |
| frantech-ts |
cmd-injection-php-cgi-rce |
61 |
12.9 |
4.7x |
| lauterbourg-01-ts |
docker-registry-manifest |
20 |
0.0 |
infx |
| lauterbourg-01-ts |
docker-registry-tags |
20 |
0.0 |
infx |
| lauterbourg-01-ts |
kiteworks-asset |
796 |
0.0 |
infx |
| lauterbourg-01-ts |
kiteworks-root-redirect |
177 |
0.0 |
infx |
| lauterbourg-01-ts |
kiteworks-shell |
74 |
0.0 |
infx |
| lauterbourg-01-ts |
not-handled |
667 |
0.0 |
infx |
| lauterbourg-01-ts |
tarpit |
59 |
0.0 |
infx |
| lauterbourg-01-ts |
tarpit-disconnect |
34 |
0.0 |
infx |
| lauterbourg-01-ts |
tarpit-module |
369 |
0.0 |
infx |
Campaign clusters (24h, journey-fingerprinted)
| signature |
IPs |
events |
sensors |
first seen |
sample journey (6 steps) |
| 3e1c5eb879e7 ⟳ |
112 |
780 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,lauterbourg-01-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 7e61a9500d8b ⟳ |
13 |
625 |
ai-devbox-1,canary-farm-1,control-1,frantech-ts,netcup-ts,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-29 |
/bin/sh [cgi-traversal-rce-command] → /bin/sh [cmd-injection-apache-cgi-shell] → /hello.world [cmd-injection-php-cgi-rce] → / [cmd-injection-php-cgi-rce] → /index.php [cmd-injection-php-cgi-rce] → /te |
| 7ea1125e0232 ⟳ |
8 |
112 |
ai-devbox-1,canary-farm-1,control-1,ru-edge-1,sponge-01-ts ⚠FLEET-WIDE |
08-30 |
/ [tarpit-module] → / [tarpit] → / [tarpit-disconnect] → / [tarpit-module] → / [tarpit] → / [tarpit-disconnect] |
| 5c4b5dc2fb71 ⟳ |
6 |
42 |
ai-devbox-1,canary-farm-1,lauterbourg-01-ts,sponge-01-ts ⚠FLEET-WIDE |
09-12 |
/robots.txt [tarpit-module] → /robots.txt [tarpit] → /robots.txt [tarpit-disconnect] |
| 321f17b2aca0 ⟳ |
5 |
36 |
ai-devbox-1,canary-farm-1,frantech-ts,netcup-ts,sponge-01-ts ⚠FLEET-WIDE |
08-31 |
/ [tarpit-module] → /favicon.ico [tarpit-module] → /geoserver/web/ [geoserver-web-landing] |
| 850993125b15 ⟳ |
4 |
164 |
canary-farm-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| b07c7bb207b4 ⟳ |
4 |
164 |
ai-devbox-1 |
08-29 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → … |
| ed66cc967251 ⟳ |
3 |
12 |
canary-farm-1 |
09-23 |
/wp-login.php [wp-login-probe] → /wp-login.php [wp-login-credentials] → /wp-login.php [wp-login-probe] → /xmlrpc.php [wp-xmlrpc-post] |
Signature = SHA-256 of the ordered path[result] sequence (≤40 steps). Same signature across IPs = one tooling campaign; IPs rotate, signatures persist.
First-seen in this window
New paths:
| sensor |
path |
first seen |
| ai-devbox-1 |
/.env.nuxt |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.env.prometheus |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.env.react |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.env.schema |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/rev-manifest.json |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.env.q4 |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.env.queue |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.env.q1 |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.env.socket |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/config/ai.php |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.git/logs/refs/remotes/origin/stage |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.git/refs/remotes/origin/uat |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.git/logs/refs/remotes/origin/test |
2026-09-26 03:15:40.622017-04:00 |
| ai-devbox-1 |
/.git/logs/refs/remotes/origin/bugfix |
2026-09-26 03:15:40.622017-04:00 |
| lauterbourg-01-ts |
/static/js/8032.72cabe88.js |
2026-09-26 03:15:40.622017-04:00 |
| lauterbourg-01-ts |
/static/js/78bebacd.chunk.js |
2026-09-26 03:15:40.622017-04:00 |
| lauterbourg-01-ts |
/static/js/6901.3d99262c.chunk.js |
2026-09-26 03:15:40.622017-04:00 |
| lauterbourg-01-ts |
/static/js/7313.50514dad.chunk.js |
2026-09-26 03:15:40.622017-04:00 |
| lauterbourg-01-ts |
/static/media/kw-logo-sign-in-white.1eeae2f2e8b18cd1e681.png |
2026-09-26 03:15:40.622017-04:00 |
| lauterbourg-01-ts |
/static/media/securedbyacc.b2d3a7c80bf34b625a99.svg |
2026-09-26 03:15:40.622017-04:00 |
New user agents:
| sensor |
user agent |
first seen |
| control-1 |
SonyEricssonK810i/R1KG Browser/NetFront/3.3 Profile/MIDP-2.0 |
2026-09-26 03:15:47.608777-04:00 |
| ru-edge-1 |
insomnia/2023.5.8 |
2026-09-26 03:15:47.608777-04:00 |
| control-1 |
cve-2026-87902-poc/1.0 |
2026-09-26 03:15:47.608777-04:00 |
| netcup-ts |
Mozilla/5.0 (Windows NT 6.2;en-US) AppleWebKit/537.32.36 (KH |
2026-09-26 03:15:47.608777-04:00 |
| lauterbourg-01-ts |
sh1kk-probe/2 |
2026-09-26 03:15:47.608777-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (X11; Ubuntu; Linux x86_64; rv:134.0) Gecko/2010 |
2026-09-26 03:15:47.608777-04:00 |
| sponge-01-ts |
Mozilla/5.0 (X11; Linux x86_64; rv:125.0) Gecko/20100101 Fir |
2026-09-26 03:15:47.608777-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 zgrab/0.x |
2026-09-26 03:15:47.608777-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Macintosh; Intel Mac OS X 14_7_6) AppleWebKit/5 |
2026-09-26 03:15:47.608777-04:00 |
| lauterbourg-01-ts |
Mozilla/5.0 (Windows NT 10.0; Win64; x64) AppleWebKit/537.36 |
2026-09-26 03:15:47.608777-04:00 |
Top talkers (24h)
| sensor |
IP |
events |
trap fams |
paths |
first |
last |
blocklist |
ASN org |
cc |
POSTed |
| canary-farm-1 |
87.120.104.29 |
2950 |
121 |
1592 |
09-25 09:50 |
09-25 09:51 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| control-1 |
204.76.203.18 |
2141 |
2 |
580 |
09-25 03:50 |
09-26 06:11 |
ipsum:2 |
Pfcloud UG (haftungsbeschran |
NL |
0 |
| canary-farm-1 |
94.154.46.246 |
2100 |
111 |
1042 |
09-25 05:32 |
09-25 05:33 |
- |
Omegatech LTD |
US |
0 |
| control-1 |
87.120.104.29 |
1239 |
114 |
1231 |
09-26 05:33 |
09-26 05:33 |
- |
Sino Worldwide Trading Limit |
NO |
0 |
| control-1 |
94.154.46.246 |
1050 |
112 |
1042 |
09-26 00:30 |
09-26 00:30 |
- |
Omegatech LTD |
US |
0 |
| ai-devbox-1 |
31.57.216.50 |
998 |
54 |
915 |
09-25 23:10 |
09-25 23:12 |
- |
VPS Dedicated LLC |
AE |
0 |
| lauterbourg-01-ts |
70.8.208.88 |
656 |
12 |
50 |
09-25 15:54 |
09-25 23:58 |
- |
Fidium |
US |
31 |
| sponge-01-ts |
185.73.23.162 |
584 |
2 |
5 |
09-25 06:21 |
09-25 09:04 |
- |
Ruhr-Universitaet Bochum |
DE |
0 |
| lauterbourg-01-ts |
161.118.198.57 |
466 |
17 |
456 |
09-26 01:43 |
09-26 01:43 |
- |
Oracle Corporation |
SG |
0 |
| canary-farm-1 |
213.209.159.175 |
400 |
62 |
314 |
09-25 12:00 |
09-26 05:35 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| control-1 |
213.209.159.175 |
385 |
66 |
298 |
09-25 08:35 |
09-26 02:48 |
ipsum:3 firehol2 |
Feo Prest SRL |
DE |
0 |
| canary-farm-1 |
136.85.48.119 |
291 |
71 |
219 |
09-25 23:59 |
09-25 23:59 |
- |
Google LLC |
SG |
32 |
| netcup-ts |
45.139.104.35 |
246 |
1 |
1 |
09-25 18:58 |
09-26 06:12 |
- |
49.3 Networking LLC |
BG |
0 |
| netcup-ts |
213.209.159.154 |
243 |
7 |
240 |
09-25 19:33 |
09-25 19:33 |
- |
Feo Prest SRL |
DE |
0 |
| frantech-ts |
213.209.159.154 |
243 |
7 |
240 |
09-26 03:41 |
09-26 03:42 |
- |
Feo Prest SRL |
DE |
0 |
Canary economics (24h)
| sensor |
mints |
distinct minting IPs |
| ai-devbox-1 |
27 |
15 |
| control-1 |
28 |
9 |
| ru-edge-1 |
9 |
7 |
| canary-farm-1 |
46 |
17 |
Mint failures (24h): ru-edge-1:400x1; canary-farm-1:400x17
Mints by type label:
| sensor |
types |
mints |
| canary-farm-1 |
["aws"] |
46 |
| ai-devbox-1 |
["aws"] |
27 |
| control-1 |
["aws"] |
28 |
| ru-edge-1 |
["aws"] |
9 |
XFF forgery signals (24h)
- requests with any X-Forwarded-For: 1838
- multi-entry XFF (forged chains — no proxy appends on the direct path): 0
- XFF present but ignored as the source (all entries internal, or it agrees with the peer): 5
- XFF naming a source other than the socket peer, from a direct connection (single-entry forgery): 1
TLS split + Host census (24h)
| sensor |
protocol |
events |
| ai-devbox-1 |
http |
1750 |
| ai-devbox-1 |
https |
119 |
| canary-farm-1 |
http |
6265 |
| canary-farm-1 |
https |
504 |
| control-1 |
http |
5606 |
| frantech-ts |
http |
1216 |
| lauterbourg-01-ts |
https |
1209 |
| lauterbourg-01-ts |
http |
1165 |
| netcup-ts |
http |
1087 |
| ru-edge-1 |
http |
559 |
| sponge-01-ts |
http |
1128 |
Top Host headers:
| sensor |
host |
events |
| canary-farm-1 |
109.123.246.142 |
6167 |
| control-1 |
38.54.2.209 |
5587 |
| ai-devbox-1 |
217.15.163.226 |
1629 |
| lauterbourg-01-ts |
kiteworks.rightabouteverything.show |
1377 |
| netcup-ts |
159.195.21.150 |
1073 |
| frantech-ts |
209.141.62.110 |
1009 |
| lauterbourg-01-ts |
89.116.25.211 |
991 |
| canary-farm-1 |
sso.rightabouteverything.show |
594 |
| ru-edge-1 |
130.94.89.46 |
552 |
| sponge-01-ts |
89.167.72.144 |
530 |
Control node discovery velocity
- first event ever: 2026-09-12 07:59 UTC (13 days live)
- daily unique-IP ramp (newest first):
| day |
events |
uniq IPs |
| 2026-09-26 |
5606 |
114 |
| 2026-09-25 |
6508 |
91 |
| 2026-09-24 |
4271 |
119 |
| 2026-09-23 |
3598 |
121 |
| 2026-09-22 |
5088 |
145 |
| 2026-09-21 |
2632 |
89 |
| 2026-09-20 |
3856 |
109 |
| 2026-09-19 |
5283 |
129 |
| 2026-09-18 |
3082 |
124 |
| 2026-09-17 |
5129 |
94 |
| 2026-09-16 |
4795 |
62 |
| 2026-09-15 |
5378 |
1 |
| 2026-09-14 |
3152 |
1 |
| 2026-09-13 |
4254 |
53 |
Kill-chain watchlist (24h)
| sensor |
IP |
trap fams |
journey (chronological) |
ASN org |
cc |
| canary-farm-1 |
87.120.104.29 |
121 |
/wp-config.php.bak [wp-config] → /.git/config [fake-git] → /.git/index [fake-git] → /config.php [app-config-php] → /settings.php [app-config-php] → /Gemfile.lock [not-handled] → /.aws/credentials [aws-credentials-file] → /config/database.php [app-config-php-database] → /package-lock.json [package-lock-json-error] → /configuration.php [app-config-php] → /wp-config.php~ [wp-config] → /local_settings.py [app-config-python] |
Sino Worldwide Trading Limit |
NO |
| control-1 |
87.120.104.29 |
114 |
/wp-config.php.save [wp-config] → /docker-compose.override.yml [docker-compose] → /wp-config.php.bak [wp-config] → /.env.bak [env-production] → /config.js [webapp-config-bundle-js] → /.env.staging [env-production] → /.ssh/authorized_keys [authorized-keys-error] → /.ssh/id_rsa [ssh-private-key-error] → /.env.local [env-production] → /wp-config.php [wp-config] → /composer.lock [not-handled] → /.dockerenv [not-handled] |
Sino Worldwide Trading Limit |
NO |
| control-1 |
94.154.46.246 |
112 |
/config/database.php [app-config-php-database] → /wp-config.bak [wp-config] → /wp-config.php.old [wp-config] → /.git/index [fake-git] → /.travis.yml [generic-ci-config] → /.circleci/config.yml [generic-ci-config] → /wp-config.php~ [wp-config] → /docker-compose.yml [docker-compose] → /wp-config.old [wp-config] → /.gitlab-ci.yml [gitlab-ci] → /.ssh/authorized_keys [authorized-keys-error] → /instance/config.py [app-config-python] |
Omegatech LTD |
US |
| canary-farm-1 |
94.154.46.246 |
111 |
/.git/config [fake-git] → /wp-config.php.bak [wp-config] → /.git/index [fake-git] → /.git/HEAD [fake-git] → /package-lock.json [package-lock-json-error] → /wp-config.php.save [wp-config] → /settings.php [app-config-php] → /configuration.php [app-config-php] → /docker-compose.override.yml [docker-compose] → /.dockerenv [not-handled] → /wp-config.php [wp-config] → /.aws/config [aws-config-file] |
Omegatech LTD |
US |
| canary-farm-1 |
136.85.48.119 |
71 |
/ [tarpit-module] → /cp50qgs0l8e0t24bkruo [not-handled] → /z9x8c7v6b5-debug-trigger-sso.rightabouteverything.show [not-handled] → /34ah7bxikwl3hxps3h2v [not-handled] → /graphql [graphql-introspection] → /config/firebase-admin.json [firebase-json] → /public/admin.json [not-handled] → /config/env/aws_credentials.env [aws-env] → /firebase-admin.json [firebase-json] → /gcp-key.json [gcp-credentials-json] → /api/graphql [graphql-introspection] → /config/gcp-credentials.json [gcp-credentials-json] |
Google LLC |
SG |
| control-1 |
213.209.159.175 |
66 |
/ [tarpit-module] → /q06wz93b2ko9hb [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| canary-farm-1 |
213.209.159.175 |
62 |
/ [tarpit-module] → /n19htdtj74jx5t [not-handled] → /.env [issued] → /rest/workflows [not-handled] → /api/.env [env-production] → /backend/.env [env-production] → /sendgrid.env [mail-service-env] → /admin/.env [env-production] → /server/.env [env-production] → /laravel/.env [env-production] → /phpinfo/ [not-handled] → /.env.example [env-production] |
Feo Prest SRL |
DE |
| ai-devbox-1 |
161.118.223.197 |
54 |
/.env.production.local [env-production] → /.env [issued] → /.env.production [env-production] → / [tarpit-module] → /.env.local [env-production] → /.env.bak [env-production] → /config.js [webapp-config-bundle-js] → /config.json [config-json] → /runtime-config.js [webapp-config-bundle-js] → /config.php.bak [app-config-php] → /env.js [webapp-config-bundle-js] → /config.yaml [app-config-yaml] |
Oracle Corporation |
SG |
| ru-edge-1 |
140.245.97.14 |
54 |
/ [tarpit-module] → /.env [issued] → /.env.production.local [env-production] → /.env.production [env-production] → /.env.local [env-production] → /.env.bak [env-production] → /config.json [config-json] → /runtime-config.js [webapp-config-bundle-js] → /config.js [webapp-config-bundle-js] → /env.js [webapp-config-bundle-js] → /config.yml [app-config-yaml] → /config.php.bak [app-config-php] |
Oracle Corporation |
SG |
| control-1 |
161.118.240.138 |
54 |
/.env.local [env-production] → / [tarpit-module] → /.env.production.local [env-production] → /.env.production [env-production] → /.env [issued] → /.env.bak [env-production] → /config.json [config-json] → /config.js [webapp-config-bundle-js] → /env.js [webapp-config-bundle-js] → /runtime-config.js [webapp-config-bundle-js] → /config.yaml [app-config-yaml] → /config.yml [app-config-yaml] |
Oracle Corporation |
SG |
| ai-devbox-1 |
31.57.216.50 |
54 |
/aura-c1clcfs7gx2c70vzn1t64wyh.txt [not-handled] → /var/www/.env [env-production] → /.svn/format [fake-svn] → /aws/config [not-handled] → /.htpasswd.bak [not-handled] → /.htaccess.bak [not-handled] → /.hg/store/ [not-handled] → /.svn/wc.db [fake-svn] → /.env [issued] → /.git/HEAD [fake-git] → /.git/credentials [fake-git] → /.git/packed-refs [fake-git] |
VPS Dedicated LLC |
AE |
| canary-farm-1 |
140.245.108.60 |
32 |
/.env [tracebit-http-error] → /.env.production [env-production-error] → /.env.local [env-production-error] → / [tarpit-module] → /.env.production.local [env-production-error] → /.env.bak [env-production-error] → /env.js [webapp-config-bundle-js-error] → /config.js [webapp-config-bundle-js-error] → /config.json [config-json-error] → /runtime-config.js [webapp-config-bundle-js-error] → /config.yml [app-config-yaml-error] → /config.yaml [app-config-yaml-error] |
Oracle Corporation |
SG |
| ai-devbox-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
| canary-farm-1 |
207.154.212.47 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
DE |
| canary-farm-1 |
167.99.181.249 |
27 |
/ [tarpit-module] → /console/ [weblogic-console-login] → /server [not-handled] → /server-status [server-status-html] → /about [not-handled] → /login.action [confluence-login] → /___proxy_subdomain_whm/login [whm-login] → /___proxy_subdomain_cpanel [whm-login] → /v2/_catalog [docker-registry-catalog] → /v2/internal/api-gateway/tags/list [docker-registry-tags] → /v2/internal/api-gateway/manifests/latest [docker-registry-manifest] → /v2/internal/auth-service/tags/list [docker-registry-tags] |
DigitalOcean, LLC |
CA |
SSH/telnet honeypot (single sensor: frantech-ts)
Own honeypots on :2222/:2323, not the flux trap surface. Condensed feed (/data/hp-logs/), deliberately not part of v_logs. One host, so read it as a single-sensor view, not a fleet number.
- funnel: 645 sources sent credentials → 517 got a shell (80%) → 288 ran a command (56% of shell-getters, 45% of sources)
- event level: 8183 credential attempts → 4088 accepted logins → 5214 commands (128% of accepted logins go on to run something)
- telnet (commodity IoT botnets): 677 attempts
New commands this window (0 of 81 distinct):
no command seen for the first time this window
Recurring commands (⟳ seen in an earlier window):
| events |
IPs |
example source |
command (head) |
| 1236 |
254 |
114.217.10.60 |
"cd ~; chattr -ia .ssh; lockr -ia .ssh" |
| 1080 |
228 |
114.217.10.60 |
"cd ~ && rm -rf .ssh && mkdir .ssh && echo "ssh-rsa AAAAB3NzaC1yc2EAAAABJQAAAQEArDp4cun2lhr4KUhBGE7VvAcwdli2a8dbnrTOrbMz1+5O73fcBOx8NVbUT0b |
| 900 |
2 |
109.160.32.19 |
"uname -s -v -n -r -m" |
| 900 |
2 |
109.160.32.19 |
"uname -m | awk '{printf $1}'" |
| 257 |
8 |
80.94.92.234 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
| 257 |
8 |
80.94.92.234 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 57 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:$PATH\nuname=$(uname -s -v -n -m 2>/dev/null || /bin/uname -s -v - |
| 57 |
1 |
62.171.133.1 |
"export PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin:${PATH:-} LC_ALL=C LANG=C\nuname=$(for c in uname /bin/uname /usr/ |
Credentials: 3479 distinct pairs offered this window, 0 new. Concentration is the signal, not the list — top pairs:
| attempts |
user |
password |
| 1201 |
345gs5662d34 |
345gs5662d34 |
| 894 |
root |
3245gs5662d34 |
| 54 |
ubuntu |
3245gs5662d34 |
| 48 |
admin |
3245gs5662d34 |
| 40 |
support |
support |
| 39 |
admin |
admin |
| 34 |
user |
3245gs5662d34 |
| 32 |
user |
wasd |